Security audit

Meeting Minutes

Security checks for vulnerabilities and agentic risk

Overview

This draft meeting-minutes skill is not malicious, but users should treat its medical compliance and broad-routing language cautiously.

Install only if you need a lightweight local helper for drafting meeting minutes from provided transcript text. Do not rely on its FDA/ICH E6 wording as proof of regulatory compliance, and review outputs manually before using them in clinical, legal, or official records.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill metadata and narrative promise a bounded, structured meeting-minutes workflow, but the content also frames the tool as broadly reusable for other workflows and introduces medical/clinical specialization without clearly scoping or enforcing those constraints. This mismatch can cause unsafe or inappropriate invocation, especially in regulated clinical contexts where users may over-trust undocumented behavior or assume compliance properties that are not actually implemented.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest description is generic and overlaps with many structured-writing or summarization tasks, making the skill's trigger surface unnecessarily broad. In a skill-routing environment, this can cause mis-selection and over-trust, especially because the package also references executable scripts and medical compliance-oriented output.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation guidance is broad enough to invite use on loosely related 'other workflows' and 'other tasks,' which weakens safety boundaries and increases the chance the skill will be selected outside its validated use case. In agentic systems, ambiguous triggering can expose inappropriate data handling, unreliable outputs, or accidental execution of packaged scripts in contexts the skill was not designed for.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The security checklist asserts protections such as path validation and restricting output to the workspace, but the documented file provides no evidence that these controls exist. If operators rely on these claims, they may run the packaged script with untrusted paths or outputs under false assumptions, increasing the risk of path traversal or unintended file writes when the underlying script is executed.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The invocation text is broad enough to match many generic structured-output tasks, which can cause the agent to route unrelated requests into this skill. In an agentic system, overbroad routing is a real security and reliability issue because it weakens scope boundaries and can trigger unintended execution paths or outputs outside the skill’s declared purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The variant trigger text is ambiguous and does not clearly define when the skill should activate, increasing the chance of false-positive routing. This is more concerning here because the audit itself records a stress-case scope-boundary failure, showing that weak activation criteria already correlate with out-of-scope behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The risk assessment at L113 states 'No external API calls', but this skill file is documentation-only and repeatedly defers actual behavior to scripts/main.py without showing supporting implementation here. That creates an intent/implementation mismatch within the documented artifact because the asserted runtime behavior is not demonstrated by the referenced code in this file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.